Softmax classifier has been widely used in state-of-the-art models for discriminative tasks due to its simplicity and efficiency. However, softmax classifier is known particularly vulnerable to adversarial attacks because the latent feature space induced by softmax classifier is typically not well separated (as shown in Fig. REF (a)). Some recent works propose to use generative classifiers to better formulate the latent space distributions in order to improve its robustness to adversarial examples. For example, Wan et al. [1]} propose to model the latent feature space as mixture of Gaussians and encourages stronger intra-class compactness and larger inter-class separability by introducing large margins between classes. Different from [1]}, Pang et al. [3]} pre-design the centroids based on the Max-Mahalanobis distribution (MMD), other than learning them from data. The authors prove that if the latent feature space distributes as an MMD, the LDA classifier will have the best robustness to adversarial examples. Taking advantage of the benefits of MMD, Pang et al. [4]} further propose a max-Mahalanobis center regression loss, which induces much denser feature regions and improves the robustness of trained models. Compared with softmax classifier, all these works can generate better latent feature spaces to improve the robustness of models for the task of classification. Our GMMC is built on the basic framework of MMC, but we reinterpret MMC as an EBM for image classification and generation. Moreover, we show that the generative training of MMC can further improve calibration, adversarial robustness and out-of-distribution detection.
